diff options
Diffstat (limited to 'libcli')
| -rw-r--r-- | libcli/security/access_check.c | 33 |
1 files changed, 28 insertions, 5 deletions
diff --git a/libcli/security/access_check.c b/libcli/security/access_check.c index 03a7dca4adf..5d49b718f0c 100644 --- a/libcli/security/access_check.c +++ b/libcli/security/access_check.c @@ -110,13 +110,15 @@ static uint32_t access_check_max_allowed(const struct security_descriptor *sd, { uint32_t denied = 0, granted = 0; unsigned i; - - if (security_token_has_sid(token, sd->owner_sid)) { - granted |= SEC_STD_WRITE_DAC | SEC_STD_READ_CONTROL; - } + uint32_t owner_rights_allowed = 0; + uint32_t owner_rights_denied = 0; + bool owner_rights_default = true; if (sd->dacl == NULL) { - return granted & ~denied; + if (security_token_has_sid(token, sd->owner_sid)) { + granted |= SEC_STD_WRITE_DAC | SEC_STD_READ_CONTROL; + } + return granted; } for (i = 0;i<sd->dacl->num_aces; i++) { @@ -126,6 +128,18 @@ static uint32_t access_check_max_allowed(const struct security_descriptor *sd, continue; } + if (dom_sid_equal(&ace->trustee, &global_sid_Owner_Rights)) { + if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED) { + owner_rights_allowed |= ace->access_mask; + owner_rights_default = false; + } else if (ace->type == SEC_ACE_TYPE_ACCESS_DENIED) { + owner_rights_denied |= (owner_rights_allowed & + ace->access_mask); + owner_rights_default = false; + } + continue; + } + if (!security_token_has_sid(token, &ace->trustee)) { continue; } @@ -143,6 +157,15 @@ static uint32_t access_check_max_allowed(const struct security_descriptor *sd, } } + if (security_token_has_sid(token, sd->owner_sid)) { + if (owner_rights_default) { + granted |= SEC_STD_WRITE_DAC | SEC_STD_READ_CONTROL; + } else { + granted |= owner_rights_allowed; + granted &= ~owner_rights_denied; + } + } + return granted & ~denied; } |